Anomaly detection method, model building method and device for sparse negative samples

Abstract

An anomaly detection method, model building method, and apparatus for sparse negative samples are disclosed. The model building method includes: clustering the sparse negative sample data into different operating conditions; cleaning null values, handling invalid values, and normalizing the current operating condition dataset; performing stationarity tests, correlation analysis, and similarity analysis on the preprocessed data; performing feature engineering based on the verification and analysis results, calculating and extracting features, and performing feature dimensionality reduction; constructing an anomaly detection model using an ensemble algorithm based on binary trees, obtaining a training set from the sample set composed of dimensionality-reduced features, and training the anomaly detection model with the training set. Considering data correlation, the method combines feature building methods of different dimensions to extract a more accurate and interpretable feature vector space, effectively handling non-stationary and nonlinear historical data, and modeling high-dimensional feature vectors of extremely imbalanced samples, thereby improving the interpretability of the algorithm model and reducing its dependence on data balance.

Description

Technical Field

[0001] The present invention belongs to the field of equipment fault diagnosis and intelligent operation and maintenance, and relates to anomaly detection, and in particular to an anomaly detection method, a model building method and a device for sparse negative samples. Background Art

[0002] Anomaly detection is an operation and maintenance guarantee service. By analyzing the monitoring parameters collected by sensors, abnormal behaviors are separated from normal behaviors, and methods are tried to detect abnormal states. Real-time running data is detected, and maintenance measures are taken for components corresponding to abnormal data to avoid serious failures caused by untimely abnormal handling. The initial anomaly detection strategy is mainly based on manually defined rules, and manual tracking and analysis are required for subsequent judgment. As the subsystems of complex equipment such as spacecraft become more and more complex and diverse, and the number of monitoring parameters increases, the rules related to anomalies become more and more complex. It is difficult to obtain comprehensive and reliable rules manually, which brings challenges to anomaly detection. Based on historical detection data, effective rules and feature information for anomaly detection are obtained through data analysis and mining, and an effective anomaly detection model is established. This can make up for the difficulties of obtaining expert rules and updating them in a timely manner, help further judge the effective status of components and equipment, provide a basis for fault diagnosis and health assessment, and provide early warning information.

[0003] Important indicators for measuring the performance of anomaly detection models are false alarm rate and missed alarm rate. The key to improving the detection rate is to fully analyze and mine the components in historical data that are effective for anomaly detection, fully consider the characteristics of multiple parameters themselves and the correlation between parameters, and establish an algorithm model with high accuracy and excellent robust performance. When an anomaly occurs, one or more groups of telemetry parameters corresponding to the algorithm model can be used to map whether the corresponding state is abnormal, or learn the deviation relationship model between the abnormal state and the normal state.

[0004] Currently, commonly used modeling algorithms include unsupervised clustering, supervised classification and regression algorithms. Pre-modeling data analysis also involves a lot. Therefore, in order to learn an algorithm model with relatively low false alarm rate and false negative rate, it is necessary to comprehensively and fully analyze and evaluate the multiple scale characteristics of a single variable and the correlation characteristics between multiple variables, and select features that can effectively measure normal and abnormal states as the input of the algorithm model. At the same time, it is also necessary to select a suitable matching algorithm.

[0005] As the reliability and redundancy of complex equipment become higher and higher, the number of anomalies or failures during testing and operation becomes less and less, so effective abnormal data becomes increasingly scarce, resulting in extremely unbalanced samples of historical data. At the same time, due to the increasing complexity of the internal structure of spacecraft, the data generated mostly show nonlinear and non-stationary characteristics. Conventional supervised algorithm models and linear regression fitting models are no longer applicable, and the basic time domain features cannot characterize the implicit characteristics of non-stationary changes in data over time. In the face of sparse negative samples in historical data, it is necessary to start with a single normal state data and establish a model to characterize the normal state data.

[0006] Under existing technical conditions, the key to establishing anomaly detection models for sparse negative sample data lies in the feature selection in the data processing stage and the selection and debugging of intelligent algorithms in the model building process, which determines the accuracy and efficiency of real-time anomaly detection. Previous strategies mainly monitor and identify the status of data based on expert threshold rules and association rules between parameters of the same model. Establishing a complete, accurate and efficient rule base requires a lot of manpower and material resources, with a low degree of automation, and even less rule information for newly developed equipment subsystems, so a sound rule base almost does not exist; the method based on pure data drive has the disadvantage of ignoring the characteristics of telemetry data itself and mutual characteristics. How to consider the characteristics of the data itself in the process of data-driven modeling is an important issue that needs to be solved for anomaly detection. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the present invention provides an anomaly detection method, a model building method and a device for sparse negative samples, which extract accurate and effective abnormal state features and learn the characteristics of normal and abnormal states in sparse negative sample data for description, consider the correlation mechanism of data in the data analysis stage, and combine feature construction methods of different dimensions to extract more accurate and explanatory feature vector space, effectively process non-stationary and nonlinear historical data, model the high-dimensional feature vectors of extremely unbalanced samples, and distinguish different working conditions for feature transfer learning, combine clustering algorithms and new heterogeneous algorithm models to realize anomaly detection model construction, improve the interpretability of algorithm models, improve the rule information of telemetry parameters, and reduce dependence on data balance.

[0008] In order to achieve the purpose of the present invention, the following scheme is proposed:

[0009] A method for constructing anomaly detection model for sparse negative samples, characterized by comprising the steps of:

[0010] S1. Cluster the different working conditions of the sample data and divide the sample data into different data sets. The sample data is a sparse negative sample. The data is divided into different working conditions according to the clustering of the sample points, and the corresponding working conditions are analyzed and modeled in the future. The anomaly detection of real-time data also needs to be detected according to the working conditions.

[0011] S2. Select the data set corresponding to the current working condition for data preprocessing, which includes null value cleaning, invalid value processing, and data normalization.

[0012] S21. Null value cleaning: Delete or fill the data set according to the proportion of null values, set the null value ratio of the row or column corresponding to the data, and when the null value is greater than the ratio, delete the row or column directly, otherwise fill it with 0 or the mean.

[0013] S22. Invalid value processing: Use a box plot to eliminate data points that meet the preset abnormality level.

[0014] S23, Data normalization: Perform linear transformation on the data set so that the result falls within the predetermined range [ a , b ]. Generally, it is in the interval [0,1] and can be converted according to the maximum and minimum values, or according to the mean and variance.

[0015] S3. Data analysis: Combined with the data characteristics of prior knowledge, the pre-processed data (telemetry data) is subjected to visual description analysis, statistical analysis, frequency domain analysis, and time-frequency domain analysis. The statistical analysis includes single-parameter stationarity test and multi-parameter correlation and similarity analysis.

[0016] S31. Visualize and describe, calculate conventional statistics, and observe and understand the distribution of data;

[0017] S32. Statistical analysis. Perform correlation analysis on data / signals, calculate Pearson, Spearman, and Kendall correlation coefficients. The thresholds of the three correlation coefficients are based on the theory of statistical analysis. According to the theory of bagging, the correlation coefficients are calculated by randomly selecting samples with replacement multiple times. First, filter out the parameter groups that do not meet the high correlation, that is, the basic correlation coefficient needs to be greater than 0.8. On the basis of meeting the preliminary conditions, calculate its expectation as the correlation coefficient threshold according to statistical theory, and this threshold can be used as a preliminary basis for judgment. Then, perform a stationarity test on the signal, and use the ADF test to evaluate whether the signal is stationary. It is also necessary to perform a similarity analysis on the signal, including calculating the Euclidean distance, Manhattan distance, and dynamic time planning, and analyzing the similarity between each pair.

[0018] S4. Feature engineering: Calculate multi-dimensional features for each subsequence sample in turn using a sliding window method, and select and extract features based on the statistical analysis characteristics of the data and the redundancy of the features.

[0019] S41, feature construction, based on the analysis results of the signal, feature extraction is performed in different domains, and the time series signal is divided into multiple subsequences in a sliding window manner. For a sequence length of N data, set the window size to m The speed of each move is p , each time you select m Calculate the feature value of the subsequence of length and then slide it on the time axis p , repeatedly calculate the eigenvalues. For stationary signals, time domain features are extracted, including dimensioned indicators such as mean, root mean square value, kurtosis, root square amplitude, peak-to-peak value, variance and standard deviation, and dimensionless indicators such as peak index, pulse index, waveform index, margin index, and kurtosis index. For non-stationary signals, time-frequency domain features are extracted, including subsequence n After layer wavelet packet decomposition, extract 2 n-1 The energy value of the decomposition coefficient on each node is decomposed in the following formula. The signal is decomposed into different scales through high-pass filter and low-pass filter respectively. The decomposition coefficient is expressed by the following formula:

[0020]

[0021] in g(k) and h(k) They represent the low-pass filter group and the high-pass filter group respectively, expressed as matrices.

[0022] The empirical mode decomposition features are extracted, the subsequences are decomposed by EMD, and the IMF components of the effective components are extracted, and the energy entropy value is calculated as the feature.

[0023] S42, feature dimensionality reduction, unsupervised correlation coefficient elimination and principal component analysis are used to reduce the dimension of the features.

[0024] S5. Anomaly detection model construction: Select an unsupervised new outlier algorithm to detect new outliers for unlabeled single-class samples. Since extremely unbalanced samples mostly contain only normal state samples, the main purpose is to describe the normal state, and the trained model also needs to be able to describe abnormal samples. Use an integrated algorithm based on a binary tree to build an anomaly detection model, use the reduced dimensionality feature vector space as the algorithm input, adjust the algorithm's pollution and other parameters, divide the sample set composed of features into a training set and a test set, use the training set to train the model and use the test set to evaluate the model.

[0025] A device for constructing anomaly detection model for sparse negative samples, comprising:

[0026] A clustering module is used to cluster the different working conditions of the sample data and divide the sample data into different data sets, wherein the sample data is a sparse negative sample;

[0027] The preprocessing module is used to select the data set corresponding to the current working condition for data preprocessing, which includes null value cleaning, invalid value processing and data normalization;

[0028] The analysis module is used to perform stationarity test, correlation analysis, and similarity analysis on the preprocessed data in combination with the data characteristics of prior knowledge;

[0029] The feature module is used to extract features from different domains based on the verification and analysis results. The preprocessed data is divided into multiple subsequences using a sliding window method, and multidimensional features are calculated for each subsequence sample in turn. The module is also used to perform unsupervised correlation coefficient elimination and principal component analysis on the features for dimensionality reduction.

[0030] The model building module is used to build an anomaly detection model by using an integrated algorithm based on a binary tree, and to obtain a training set from a sample set composed of features after dimensionality reduction, and to train the anomaly detection model with the training set.

[0031] A method for anomaly detection for sparse negative samples comprises the steps of: extracting features and reducing the dimension of input real-time sparse negative sample data, then inputting an anomaly detection model obtained by a method for building an anomaly detection model for sparse negative samples, using the anomaly detection model to perform anomaly discrimination, and outputting anomaly detection results.

[0032] An anomaly detection device for sparse negative samples, comprising:

[0033] Feature extraction module, used to extract features and reduce dimension of input real-time sparse negative sample data;

[0034] An anomaly detection model is used to use the features processed by the feature extraction module as input to perform anomaly discrimination and output anomaly detection results; the anomaly detection model is obtained through the anomaly detection model construction method for sparse negative samples or through the anomaly detection model construction device for sparse negative samples.

[0035] A sparse negative sample anomaly detection device comprises: at least one processor and a memory; wherein the memory stores computer-executable instructions; the computer-executable instructions stored in the memory are executed on the at least one processor, so that the at least one processor executes a sparse negative sample anomaly detection model construction method or an anomaly detection method for sparse negative samples.

[0036] A computer-readable storage medium stores a computer program, which, when executed by a processor, controls a device where the storage medium is located to execute a method for constructing an anomaly detection model for sparse negative samples, or to execute an anomaly detection method for sparse negative samples.

[0037] The beneficial effects of the present invention are:

[0038] The present invention is aimed at sparse negative sample data mainly from high-reliability and high-redundancy system components. Such data are often accompanied by a variety of working conditions involved in this working condition, numerous manifestations of abnormal states and inconsistent indicators. The solution of the present invention only requires normal state sample data in the operation and testing phases and a priori basic data characteristics, and different working conditions can be distinguished and modeled separately. It can also extract reasonable and effective features in multiple domains in combination with correlation mechanism analysis, and train an anomaly detection model for real-time data anomaly detection, thereby improving the utilization efficiency of test data and prior knowledge, and improving the accuracy and robustness of state detection and state monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are for illustrative purposes only of selected embodiments and not all possible implementations, and are not intended to limit the scope of the present invention.

[0040] Figure 1 This is an overall flow chart of the anomaly detection method for sparse negative samples according to an embodiment of the present application.

[0041] Figure 2 This is the process of constructing the derived features of the embodiment of the present application.

[0042] Figure 3 This is a flowchart for constructing an anomaly detection model according to an embodiment of the present application.

[0043] Figure 4 Schematic diagram of an anomaly detection model according to an embodiment of the present application.

[0044] Figure 5 This is a schematic diagram of anomaly detection results according to an embodiment of the present application.

[0045] Figure 6 This is a structural block diagram of the anomaly detection model construction device of an embodiment of the present application.

[0046] Figure 7 This is a structural block diagram of an abnormality detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings.

[0048] In one aspect of the embodiments of the present application, a method for constructing an anomaly detection model for sparse negative samples is provided. Figure 1 As shown in the modeling layer process diagram in, it specifically includes the following steps:

[0049] S0. First, historical data of the target object is obtained from the historical database as sample data. The sample data is a sparse negative sample, which belongs to the data of a complex equipment system.

[0050] S1. Perform kmeans clustering on different flight conditions of sample data of complex equipment systems, and divide historical data into attitude stabilization condition and attitude maneuvering condition according to the clustering of three-axis attitude data. Since the three-axis attitude data is three-dimensional data, Manhattan distance is selected as the clustering standard. For the given sample data, the predetermined number of clusters is set to 5. According to the distribution of the silhouette coefficient and the distance between classes, the elbow method is used to determine that the current sample data is divided into 2 clusters, and the attitude data angular velocity and angle information are combined to determine the condition as attitude stabilization and attitude maneuvering, and the sample data is divided into two corresponding data sets: the data set of attitude stabilization condition is 54,366, and the data set of attitude maneuvering condition is more than 1,700.

[0051] S2. Select the data set corresponding to the current working condition for data preprocessing. Data preprocessing includes null value cleaning, invalid value processing, data normalization, and data screening and fusion based on prior characteristic information of the data.

[0052] S21. Null value cleaning: Delete or fill the data set according to the proportion of null values, set the null value ratio of the row or column corresponding to the data, and directly delete the row or column when the null value is greater than the ratio, otherwise fill it with 0 or the mean value. For example: in the case of test task interruption and error recording and redundant component hot backup data with null values, delete the columns with null value ratio greater than 20%, and set / fill the null values ​​of the remaining columns to the mean value of the column data.

[0053] S22. Invalid value processing: Use a box plot to eliminate data points that meet the preset abnormality level.

[0054] First calculate the maximum and lower quartile of the data set Q 1. Median Q 2. Upper quartile Q 3, then calculate the minimum estimate Q 1- k ( Q 3- Q 1) The maximum estimated value is Q 3+ k ( Q 3- Q 1), k= 1.5 indicates moderate abnormality,k= 3 indicates extreme abnormality, and extremely abnormal data points are removed.

[0055] S23, Data normalization: Perform linear transformation on the data set so that the result falls within the predetermined range [ a , b ]. Generally, it is in the interval [0,1], and can be converted according to the maximum and minimum values, or according to the mean and variance. In the case where the test data does not obey the statistical distribution, the maximum and minimum values ​​that do not require the distribution are normalized and fall within the interval [0,1]. The conversion formula is: x * = xi - min ( xi ) / ( max ( xi )- min ( xi )), xi Represent the values ​​of the test data, calculate the maximum and minimum values ​​of the telemetry parameters, and convert all parameters so that they can be compared and calculated at the same magnitude.

[0056] S3. Data analysis: Combining the data characteristics with prior knowledge, we know that there is correlation between the telemetry data at different angles. We perform visual descriptive analysis, statistical analysis, frequency domain analysis, and time-frequency domain analysis on the preprocessed data. The statistical analysis includes single-parameter stationarity test and multi-parameter correlation and similarity analysis.

[0057] S31: Visual description analysis, calculate the mean, variance, median and maximum of conventional statistics, observe the changes in statistics in different test sections, and draw one-dimensional, two-dimensional and three-dimensional visual distribution observations of the data.

[0058] S32. In the statistical analysis, correlation analysis was performed on the data, and the Pearson, Spearman, and Kendall correlation coefficients between all variables were calculated, and the variable pairs with correlation coefficients greater than 0.8 were recorded; the data were checked for stationarity, and the ADF test was used to evaluate whether the signal was stationary. The confidence level was set to 95%, and the stationarity was analyzed together with the one-dimensional scatter plot and the test value; similarity analysis was achieved by calculating the Euclidean distance, Manhattan distance, and dynamic time planning to analyze the similarity between the two variables.

[0059] S4. Feature engineering: Calculate multi-dimensional features for each subsequence sample in turn using a sliding window method, and select and extract features based on the statistical analysis characteristics of the data and the redundancy of the features.

[0060] S41, feature construction, the process is as follows Figure 2As shown, according to the verification and analysis results, the features of different domains are extracted, and the time series signal is divided into multiple subsequences in a sliding window manner. N data, set the window size to m The speed of each slide is p , each time you select m Calculate the feature value of the subsequence of length and then slide it on the time axis p , repeatedly calculate the eigenvalues. Specifically, divide the parameter pairs with correlation coefficients greater than 0.8 in S3 into windows, set the window size to 1000, and the speed of each movement to 200. Calculate the correlation coefficient of each subsequence pair and save it in the data table.

[0061] If the stability check is stable, such as stable angular velocity and position signals, time domain features are extracted, including dimensional indicators and dimensionless indicators. Dimensional indicators include mean, root mean square value, kurtosis, root square amplitude, peak-to-peak value, variance and standard deviation. Dimensionless indicators include peak indicator, pulse indicator, waveform indicator, margin indicator and kurtosis indicator.

[0062] If the stability check is not stable, such as non-stationary zero bias and too sensitive angle signals, extract the time-frequency domain features, including wavelet packet features and EMD features. Extracting wavelet packet features is to perform subsequence n After layer wavelet packet decomposition, extract 2 n-1 The energy value of the decomposition coefficient on each node is decomposed in the following formula. The preprocessed data is decomposed into different scales through high-pass filter and low-pass filter respectively:

[0063] ;

[0064] in g(k) and h(k) They represent the low-pass filter group and the high-pass filter group respectively, expressed as matrices.

[0065] Specifically, the energy values ​​of the decomposition coefficients on 8 nodes can be extracted after performing 3-layer wavelet packet decomposition on the subsequence. Extracting EMD features (empirical mode decomposition features) is to perform EMD decomposition on the subsequence, extract the first 5 IMF components with higher effective components, and calculate the energy entropy value as the feature.

[0066] If the correlation analysis satisfies the correlation, the correlation coefficient features are extracted; if the correlation is not satisfied, the process ends.

[0067] S42, feature dimensionality reduction, for the unsupervised situation of sparse negative samples, unsupervised correlation coefficient elimination and principal component analysis (PCA) are used to reduce the dimension of the features. The preason correlation coefficient between feature vectors is calculated respectively. For feature combinations with correlation coefficients exceeding 0.8, one of the features is eliminated, and redundant features are recursively eliminated.

[0068] For high-dimensional feature vector sets with low correlation coefficients, PCA is used for dimensionality reduction. The high-dimensional features are converted into a set of linearly unrelated variables through orthogonal transformation. The converted set of variables is the principal component, which can effectively reduce the dimensionality of the derived features with more constructions. Specifically: First, the original d-dimensional data is standardized, the variance matrix of the sample is constructed, the eigenvalues ​​and corresponding eigenvectors of the covariance matrix are calculated, and the eigenvectors corresponding to the first k largest eigenvalues ​​are selected, where k is the dimension of the new feature space (k<=d). The mapping matrix W is constructed through the first k eigenvectors, and the d-dimensional input data set X is converted to the new k-dimensional feature subspace through the mapping matrix W, and the principal component that can make the variance contribution rate reach 95% is selected.

[0069] S5. Anomaly detection model construction: Select an unsupervised new heterogeneous algorithm, use an integrated algorithm based on binary tree to build an anomaly detection model, use the reduced dimension feature vector space as the algorithm input, adjust the algorithm's pollution and other parameters, divide the sample set composed of features into training set and test set, use the training set to train the model and use the test set to evaluate the model.

[0070] S51. Divide the sample set composed of the extracted feature vectors into a training set and a test set according to different random number seeds and different ratios. The specific ratio can be 0.4, and the sample set is divided into a training set train_set and a test set test_set. Call the sample processing interface in sklean.

[0071] S52. For extremely unbalanced samples, the machine learning algorithm for modeling must include two key points. One is that there should be no restrictions on labels, and the other is that it requires not only samples that can describe normal states, but also samples that can describe abnormal states. When an abnormality occurs in a device, the monitoring parameters will often show characteristics that are different from those in the normal state in a certain domain. This is because the abnormal data of sparse negative samples are few and different. Therefore, how to divide normal and abnormal data and characterize the basis for dividing abnormalities is a requirement of the algorithm model. The anomaly detection algorithm used in this example is an integrated algorithm based on a binary tree. The basis for its division is that the sparse abnormal data is few and different, and the nodes through the tree can be separated according to the differences in feature attributes. Normal samples are clusters with higher density retained after clustering, so they need to be divided multiple times to be isolated. Abnormal points with lower density are more likely to be isolated. The constructed process is as follows: Figure 3As shown in the figure, it mainly includes tree generation and integration, and abnormal identification.

[0072] Tree generation and ensemble includes:

[0073] S521. Randomly select 256 sample points from the normal samples as the root nodes of the binary tree;

[0074] S522, randomly select an attribute q of the sample set (composed of the features obtained in the previous step), and use a random value between the maximum and minimum values ​​of the attribute value q_value of the attribute q as the split point p, and set the tree depth h_limit= ceiling (log2256), ceiling Indicates the rounding of the calculated value of the logarithmic function;

[0075] S523, determine whether the depth of the current node reaches the maximum depth of the preset tree, and whether the attribute value q_value in the sample set differs by no more than a predetermined percentage. By adding a difference threshold criterion, it is avoided that too many nodes in the tree lead to high complexity of the algorithm model, and that different forms of abnormal data exist in the same batch of samples due to different mechanisms of abnormal states, and there are also differences between abnormal data caused by different reasons. Then, according to the comparison of the attribute q_value of each sample point and the split point p, it is divided into left and right child nodes, and multiple binary trees are constructed cyclically.

[0076] If the depth of the current node does not reach the maximum depth of the preset tree, and the attribute value q_value in the sample set differs by more than a predetermined percentage, then the difference between the segmentation point p and the attribute value q_value of each sample point is determined. If the difference is greater than 0, it is taken as the left node, and then S522 is executed in a loop. If the difference is less than or equal to 0, it is taken as the right node, and then S522 is executed in a loop.

[0077] If the depth of the current node reaches the maximum depth of the preset tree, or the attribute value q_value in the sample set does not differ by more than a predetermined percentage, the leaf node is determined, a tree is output, and it is determined whether the number of trees currently output reaches the preset value. If not, S522 is executed in a loop. If so, the process ends.

[0078] The anomaly detection model formed is as follows Figure 4 shown.

[0079] Abnormal identification includes:

[0080] S531, the sample x Traverse each tree;

[0081] S532: The average depth of each tree node is used as the path length. h ( x ),Includen The average tree path length of the data set X with samples is c ( x )=2 H ( n -1)-2( n -1) n ,in, H ( n -1)= ln ( n -1)+0.5772156649;

[0082] S533. Calculate anomaly score s ( x , n )=2- E ( h ( x )) c ( n ), when the sample x Path expectations E ( h ( x ))→ c ( n )hour, s →0.5, it is difficult to distinguish whether it is an abnormality. E ( h ( x ))→0 o'clock, s →1, the anomaly score is close to 1, which is considered abnormal. E ( h ( x ))→ n -1, judged as normal.

[0083] S6: Model evaluation. Since there are no abnormal samples in the current data set, but the data under different working conditions vary greatly, the model is evaluated using interactive validation. The data of the maneuvering segment is used to evaluate the stable segment. The anomaly detection accuracy can reach 95%. Conventional classification algorithms such as SVM or random forests require the introduction of balanced and labeled negative samples during the model training phase, so they are not suitable for this kind of unlabeled and non-extremely unbalanced data.

[0084] On this basis, another aspect of the embodiment of the present application provides an anomaly detection method for sparse negative samples, such as Figure 1 As shown in the detection layer process, it specifically includes the following steps:

[0085] The input real-time sparse negative sample data is subjected to feature extraction and dimension reduction, and then the anomaly detection model obtained by the construction method of the embodiment of the present application is input, anomaly detection is performed using the anomaly detection model, and anomaly detection results are output.

[0086] Specifically, the derived features are extracted from the real-time data according to the corresponding feature construction method, and the dimension reduction is performed. The features are used as the input of the trained anomaly detection model to detect the real-time data. Compared with the threshold anomaly discrimination method set by the posture data, the accuracy can be improved by more than 90%. Figure 5 As shown in the figure, the data outside the two vertical lines are all stable data. 60% of them are used as the training set to train the anomaly detection model, and the detection accuracy of abnormal data Error can reach 98%.

[0087] Furthermore, a sample library is constructed based on the anomaly detection results for model evaluation.

[0088] Another aspect of the present application is to provide a device for constructing an anomaly detection model for sparse negative samples. Figure 6 As shown, it includes clustering module, preprocessing module, analysis module, feature module and model building module.

[0089] The clustering module is used to perform clustering division on different working conditions of the sample data, and divide the sample data into different data sets, wherein the sample data is a sparse negative sample. The specific clustering division method of the clustering module is as described in S1 in the above embodiment.

[0090] The preprocessing module is used to select a data set corresponding to the current working condition for data preprocessing, and the data preprocessing includes null value cleaning, invalid value processing and data normalization. The specific data preprocessing method of the preprocessing module is as described in S2 in the above embodiment.

[0091] The analysis module is used to perform stationarity test, correlation analysis and similarity analysis on the preprocessed data in combination with the data characteristics of prior knowledge. The specific verification and analysis method of the analysis module is as described in S3 in the above embodiment.

[0092] The feature module is used to extract features of different domains according to the verification and analysis results. The extraction uses a sliding window method to divide the preprocessed data into multiple subsequences, and calculates multidimensional features for each subsequence sample in turn; and is used to perform unsupervised correlation coefficient elimination and principal component analysis on the features for dimensionality reduction. The specific calculation, extraction and dimensionality reduction methods of the feature module are described in S4 of the full text embodiment.

[0093] The model building module is used to build an anomaly detection model using an integrated algorithm based on a binary tree, and obtain a training set from a sample set composed of features after dimensionality reduction, and train the anomaly detection model with the training set. The specific construction method of the model building module is shown in S5 of the above embodiment.

[0094] Another aspect of the present application provides an anomaly detection device for sparse negative samples, such as Figure 7 As shown, it includes a feature extraction module and an anomaly detection model. Specifically, the anomaly detection model is obtained by the anomaly detection model construction method for sparse negative samples or the anomaly detection model construction device for sparse negative samples in the embodiment of the present application.

[0095] The feature extraction module is used to extract derived features from real-time data according to the corresponding feature construction method, and perform dimensionality reduction processing as the input of the trained anomaly detection model; the anomaly detection model is used to use the features processed by the feature extraction module as input for anomaly discrimination and output anomaly detection results.

[0096] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising: at least one processor and a memory; wherein the memory stores computer-executable instructions; the computer-executable instructions stored in the memory are executed on the at least one processor, so that the at least one processor executes the method for constructing an anomaly detection model for sparse negative samples or the anomaly detection method for sparse negative samples described in the embodiment of the present application.

[0097] In another aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the device where the storage medium is located is controlled to execute the method for constructing an anomaly detection model for sparse negative samples described in the embodiment of the present application, or to execute the anomaly detection method for sparse negative samples.

[0098] The above are only preferred embodiments of the present invention, and are not intended to be the only or limiting embodiments of the present invention. Those skilled in the art should understand that various changes or equivalent substitutions made to the present invention without departing from the scope of the present invention are within the scope of protection of the present invention.

Claims

1. A method for constructing anomaly detection model for sparse negative samples, characterized in that: Includes steps: S1. Clustering the different working conditions of the sample data to divide the sample data into different data sets, where the sample data is a sparse negative sample; S2. Select the data set corresponding to the current working condition for data preprocessing, which includes null value cleaning, invalid value processing and data normalization; S3, combining the data characteristics of prior knowledge to conduct stationarity test, correlation analysis and similarity analysis on the preprocessed data; S4. Feature Engineering: S41, feature construction, extracting features of different domains according to the verification and analysis results, extracting the preprocessed data into multiple subsequences by sliding window method, and calculating multidimensional features for each subsequence sample in turn; S42, feature dimensionality reduction, unsupervised correlation coefficient elimination and principal component analysis are used to reduce the dimension of the features; S5. Use an integrated algorithm based on a binary tree to build an anomaly detection model, obtain a training set from a sample set composed of features after dimensionality reduction, and train the anomaly detection model with the training set; The anomaly detection model is constructed using an integrated algorithm based on binary trees, including tree generation and integration: S521, randomly selecting a predetermined number of sample points from normal samples as root nodes of the binary tree; S522, randomly select an attribute q of the sample set, and use a random value between the maximum and minimum values ​​of the attribute value q_value of the attribute q as the split point p, and set the tree depth h_limit= ceiling (log2256); S523, judging whether the depth of the current node reaches the maximum depth of the preset tree, and whether the difference of the attribute value q_value in the sample set does not exceed a predetermined percentage; If the depth of the current node does not reach the maximum depth of the preset tree, and the attribute value q_value in the sample set differs by more than a predetermined percentage, then the difference between the segmentation point p and the attribute value q_value of each sample point is determined. If the difference is greater than 0, it is taken as the left node, and then S522 is executed in a loop. If the difference is less than or equal to 0, it is taken as the right node, and then S522 is executed in a loop. If the depth of the current node reaches the maximum depth of the preset tree, or the attribute value q_value in the sample set does not differ by more than a predetermined percentage, then the leaf node is determined, a tree is output, and it is determined whether the number of the currently output tree reaches the preset value. If not, S522 is executed repeatedly. If yes, the process ends. The anomaly detection model is constructed using an integrated algorithm based on a binary tree, which also includes anomaly discrimination: S531, the sample x Traverse each tree; S532: The average depth of each tree node is used as the path length. h ( x ),Include n The average tree path length of the data set X with samples is c ( x )=2 H ( n -1)-2( n -1) n ,in, H ( n -1)= ln ( n -1)+0.5772156649; S533. Calculate anomaly score s ( x , n )=2- E ( h ( x )) c ( n ), when the sample x Path expectations E ( h ( x ))→ c ( n )hour, s →0.5, it is difficult to distinguish whether it is an abnormality. E ( h ( x ))→0 o'clock, s →1, the anomaly score is close to 1, which is considered abnormal. E ( h ( x ))→ n -1, judged as normal.

2. The method for constructing anomaly detection model for sparse negative samples according to claim 1, characterized in that: Specifically, S1 performs kmeans clustering on different flight conditions of sample data of complex equipment systems, selects Manhattan distance as the clustering standard, sets a predetermined number of clusters for given sample data, and uses the elbow method to determine whether the current sample data is divided into two clusters based on the distribution of silhouette coefficient and inter-class distance. The angular velocity and angle information of the attitude data are combined to determine that the working condition is the attitude stabilization stage and the attitude maneuvering stage, and the sample data is divided into two corresponding data sets.

3. The method for constructing anomaly detection model for sparse negative samples according to claim 1, characterized in that: According to the verification and analysis results, feature extraction of different domains is performed, specifically: If the stability check is stable, extract the time domain features, including dimensional indicators and dimensionless indicators. Dimensional indicators include mean, root mean square value, kurtosis, root square amplitude, peak-to-peak value, variance and standard deviation. Dimensionless indicators include peak indicator, pulse indicator, waveform indicator, margin indicator and kurtosis indicator. If the stability check is not stable, extract the time-frequency domain features, including wavelet packet features and EMD features. Extracting wavelet packet features is to perform n After layer wavelet packet decomposition, extract 2 n-1 The energy value of the decomposition coefficient on each node is decomposed in the following formula. The preprocessed data is decomposed into different scales through high-pass filter and low-pass filter respectively. in g(k) and h(k) Respectively represent the low-pass filter group and the high-pass filter group, expressed as matrices; Extracting EMD features is to perform EMD decomposition on the subsequence, extract the IMF components of the effective components, and calculate the energy entropy value as the feature; If the correlation analysis satisfies the correlation, the correlation coefficient feature is extracted; If the correlation is not met, end.

4. A device for constructing anomaly detection model for sparse negative samples, characterized in that: include: A clustering module is used to cluster the different working conditions of the sample data and divide the sample data into different data sets, wherein the sample data is a sparse negative sample; The preprocessing module is used to select the data set corresponding to the current working condition for data preprocessing, which includes null value cleaning, invalid value processing and data normalization; The analysis module is used to perform stationarity test, correlation analysis, and similarity analysis on the preprocessed data in combination with the data characteristics of prior knowledge; The feature module is used to extract features from different domains based on the verification and analysis results. The extraction uses a sliding window method to divide the preprocessed data into multiple subsequences, and calculates multidimensional features for each subsequence sample in turn; It is also used to reduce the dimension of features by unsupervised correlation coefficient elimination and principal component analysis; A model building module is used to build an anomaly detection model using an integrated algorithm based on a binary tree, and to obtain a training set from a sample set composed of features after dimensionality reduction, and to train the anomaly detection model using the training set; Among them, an anomaly detection model is constructed using an integrated algorithm based on a binary tree, including tree generation and integration: S521, randomly selecting a predetermined number of sample points from normal samples as root nodes of the binary tree; S522, randomly select an attribute q of the sample set, and use a random value between the maximum and minimum values ​​of the attribute value q_value of the attribute q as the split point p, and set the tree depth h_limit= ceiling (log2256); S523, judging whether the depth of the current node reaches the maximum depth of the preset tree, and whether the difference of the attribute value q_value in the sample set does not exceed a predetermined percentage; If the depth of the current node does not reach the maximum depth of the preset tree, and the attribute value q_value in the sample set differs by more than a predetermined percentage, then the difference between the segmentation point p and the attribute value q_value of each sample point is determined. If the difference is greater than 0, it is taken as the left node, and then S522 is executed in a loop. If the difference is less than or equal to 0, it is taken as the right node, and then S522 is executed in a loop. If the depth of the current node reaches the maximum depth of the preset tree, or the attribute value q_value in the sample set does not differ by more than a predetermined percentage, then the leaf node is determined, a tree is output, and it is determined whether the number of the currently output tree reaches the preset value. If not, S522 is executed repeatedly. If yes, the process ends. The anomaly detection model is constructed using an integrated algorithm based on a binary tree, which also includes anomaly discrimination: S531, the sample x Traverse each tree; S532: The average depth of each tree node is used as the path length. h ( x ),Include n The average tree path length of the data set X with samples is c ( x )=2 H ( n -1)-2( n -1) n ,in, H ( n -1)= ln ( n -1)+0.5772156649; S533. Calculate anomaly score s ( x , n )=2- E ( h ( x )) c ( n ), when the sample x Path expectations E ( h ( x ))→ c ( n )hour, s →0.5, it is difficult to distinguish whether it is an abnormality. E ( h ( x ))→0 o'clock, s →1, the anomaly score is close to 1, which is considered abnormal. E ( h ( x ))→ n -1, judged as normal.

5. A method for anomaly detection based on sparse negative samples, characterized in that: Includes steps: The input real-time sparse negative sample data is subjected to feature extraction and dimension reduction, and then the anomaly detection model obtained by the anomaly detection model construction method for sparse negative samples described in any one of claims 1 to 3 is input, anomaly discrimination is performed using the anomaly detection model, and an anomaly detection result is output.

6. An anomaly detection device for sparse negative samples, characterized in that: include: Feature extraction module, used to extract features and reduce dimension of input real-time sparse negative sample data; An anomaly detection model is used to use the features processed by the feature extraction module as input for anomaly discrimination and output anomaly detection results; the anomaly detection model is obtained by the anomaly detection model construction method for sparse negative samples described in any one of claims 1 to 3, or by the anomaly detection model construction device for sparse negative samples described in claim 4.

7. An anomaly detection device for sparse negative samples, comprising: At least one processor and a memory; wherein the memory stores computer-executable instructions; characterized in that the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method for constructing an anomaly detection model for sparse negative samples as described in any one of claims 1 to 3, or executes the method for anomaly detection for sparse negative samples as described in claim 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the device where the storage medium is located is controlled to execute the method for constructing an anomaly detection model for sparse negative samples as described in any one of claims 1 to 3, or to execute the method for anomaly detection for sparse negative samples as described in claim 5.

Images